Cursor Origin Apps: Install, Build and Publish to the Marketplace

Origin is currently in early beta, and Apps is the part of its codebase settings where you install and manage integrations for your repositories. This section sorts the three kinds, because the install path and the audience differ for each.

In early beta you can connect the third-party apps listed in the Origin App Marketplace, and you need to sign in to Cursor to browse it. One boundary from the docs matters for planning: the Depot and Buildkite apps work on Origin-hosted repositories only, not on repositories mirrored from GitHub. Mirrored repositories keep their CI on GitHub.

All apps authenticate the same way, with app JWTs and installation access tokens. Base URL, authentication, scopes, webhooks and endpoint reference live in the Origin API documentation, and our walkthrough of that API covers the authentication chain in detail.

A private app is how a team gets API access to its own Origin repositories. The sequence has two halves, registering the app and installing it, and you must be a workspace admin to install the app.

1. 1Generate an Ed25519 key pair. Only Ed25519 keys are accepted: openssl genpkey -algorithm ED25519 -out origin-app-private.pem, then openssl pkey -in origin-app-private.pem -pubout -out origin-app-public.pem.
2. 2In Origin app settings, create the app and add the contents of origin-app-public.pem as a signing key. An app holds up to 10 active signing keys, and apps stay private until you publish them.
3. 3Copy the App ID from the app's page. App IDs start with app_.
4. 4From the app's install page, install the app on the owner that holds the repositories you clone, and select those repositories.
5. 5Copy the installation ID from the URL of the installation's page, /codebase/settings/apps/installations/{installationId}. Installation IDs start with i_.

You can also read installation IDs programmatically by calling List App Installations with an app JWT as the bearer. The response includes each installation's id, target.slug, scopes and repoSelectionMode, which is useful once an app is installed in more than one place.

Visibility is the control that moves an app from your own namespace to the whole marketplace, and it has three settings. Knowing what each one allows is what keeps a test install from turning into an accidental launch.

• Private: where new apps start. Only your namespace can view and install the app.
• Public: any Origin team can install the app from a direct link. It is not in the marketplace until Cursor approves it, and a Public app needs at least one default scope.
• Listed: the public app appears in the marketplace.

Namespace admins switch an app between Private and Public in the Visibility row of the Edit App page, and the docs suggest setting an app to Public to test it outside your namespace. The marketplace install URL has the form https://cursor.com/codebase/apps/install?client_id=<APP_ID>&source=app-metadata&returnTo=/codebase/settings/apps, where client_id is the app ID and not the slug. Do not add scope or redirect_uri to it, because those start the partner-initiated install and not the marketplace flow.

Going backwards has consequences worth knowing before you do it. Unlisting an app or making it Private hides it from the marketplace, but existing installs keep working. Making a previously listed app Public again does not relist it, so you submit it again to get it back. The public listing page at cursor.com/codebase/apps/public/<slug> works only after the app is listed.

Publishing is a review process, not a toggle. Partners build in their own namespace, make the app Public, record a demo and submit, and Cursor reviews every submission before it lists the app for every Origin team.

1. 1Create a private Origin app in your own namespace and build and test it there.
2. 2Make the app Public from Edit App, and test the install with the marketplace URL.
3. 3Record a demo video of the required flows, about 5 to 10 minutes long.
4. 4Click Submit to marketplace next to Edit App. A namespace admin provides the demo video link, an app description, and optionally a slug and suggested tags.
5. 5After Cursor approves the app it is Listed, and you get an email. You also get a confirmation email when you submit.

The demo link has to be viewable without signing in, for example an unlisted YouTube video or a public Google Drive link. The slug is optional but permanent: it is the app's unique identifier in its marketplace URL and cannot be changed after the app is listed. The approval checklist has four items: the app is Public and installs from the direct link, the demo covers the required flows, the description covers the app and its main flows, and the app follows the Origin brand guidelines.

Three flows are required in every demo. Your main product flows come first, for example a CI app posting check runs or a code review app posting review comments. Install from Origin follows: someone installs and consents to your default scopes, Origin redirects to your first redirect URI, both Origin and your product show Installed, and the install works on a personal namespace and a team, with all repositories and with selected ones. Uninstall closes it out from either side: uninstalling from Origin Apps must leave your product showing disconnected and receiving no webhooks, and disconnecting from your product must remove the installation from Origin Apps.

Four more flows are shown only if your app supports them: installing from your own site, handling new and existing users of your product during install, linking a repository to a project, and updating scopes.

Origin does not prompt an admin on its own when your app wants more access, so the request is something your product has to start. This section covers the mechanics and the one webhook that tells you the result.

Send the workspace admin back to https://cursor.com/codebase/apps/install with the extra scope. The button reads Reinstall, it updates the same install, and the same page can switch between all and selected repositories. Pass include_granted_scopes=true to keep what the admin already granted and ask only for the new scopes, shown as New Permissions and Granted Permissions. Without that flag, scope= replaces the grant.

If nothing changed, Origin shows a message that no changes were made and does not send installation.updated. When scopes or repositories do change, Origin sends installation.updated to your app's webhook, and you do not need to subscribe to it. Manage in Origin Apps changes repositories only, never scopes, and if the admin cancels the update, the old scopes stay.